← All rules
SOCLE-CLD-GEN-051// Hardening (misc)mediumpersistent config

Set PAM Password Hashing Algorithm - password-auth

Forces PAM (pam_unix.so) to hash user passwords with a strong algorithm, yescrypt or sha512, instead of a weak legacy scheme.

Checked against the content of a persistent configuration file, the source of truth that survives reboots.

A pass proves? running now✓ on disk✓ survives rebootthe qualified verdict →
Debian 12CIS 1.1.0Debian 13CIS 1.0.0FedoraRHEL 10 / Rocky 10 / AlmaLinux 10RHEL 8 / Rocky 8 / AlmaLinux 8CIS 4.0.0RHEL 9 / Rocky 9 / AlmaLinux 9CIS 2.0.0Ubuntu 22.04CIS 3.0.0Ubuntu 24.04CIS 1.0.0Ubuntu 26.04
One check, maps to 4 standards

A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.

Why this rule matters

Stored passwords are only as safe as the hashing algorithm protecting them. Weak schemes (DES, MD5) are fast to brute-force and trivially cracked from a leaked /etc/shadow, putting every account at risk. Modern algorithms, yescrypt (default on Debian/Ubuntu) and sha512, are slow and salted, drastically raising the cost of offline cracking. Configuring pam_unix.so to use them ensures any password set or changed is stored with strong protection.

What Pavois checks

Pavois greps the active PAM stack under /etc/pam.d/ for a pam_unix.so line carrying sha512 or yescrypt. PAM is the component that actually computes the hash at password-set time, so verifying its configuration captures the policy that will be enforced, more reliable than guessing from already-stored hashes, which only reflect past changes.

describe command('grep -qrE \'pam_unix.so.*(sha512|yescrypt)\' /etc/pam.d/ 2>/dev/null && echo ok || echo ko') do
  its('stdout.strip') { should eq 'ok' }
end

How to verify it is applied

Run grep -rE 'pam_unix.so.*(sha512|yescrypt)' /etc/pam.d/. The expected output is at least one matching password line (e.g. password ... pam_unix.so ... yescrypt). You can also check the hash of a real account with getent shadow root, a $y$ prefix is yescrypt, $6$ is sha512.

Inspect & investigate

Password changes are recorded via journalctl and /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL). passwd and PAM emit entries there on each password update; the resulting hash format is visible in /etc/shadow.

Remediation

No automated harden plan is defined, so this must be applied manually: ensure the password line for pam_unix.so in /etc/pam.d/common-password (Debian/Ubuntu) or the password-auth/system-auth files (RHEL) includes yescrypt or sha512, and on RHEL set the system-wide default with authselect or /etc/login.defs (ENCRYPT_METHOD SHA512/YESCRYPT).

Pavois applies this with its own harden engine, the plan below, not a shell script:

command# Ensure pam_unix uses a strong hash. Preferred: set in /etc/login.defs: ENCRYPT_METHOD YESCRYPT # (pavois's logindefs-encrypt_method does this). If the benchmark requires the option on the PAM # line, add 'yescrypt' to the pam_unix.so line in /etc/pam.d/common-password (via pam-auth-update).
reasonchanging the pam_unix hashing option edits the PAM stack, apply via pam-auth-update / review
resourcemanual
pavois harden plan local

where the target is local, a user@host SSH alias, or a container , Docs

Impact & precautions

Changing the hashing algorithm does not rehash existing passwords, they keep their old format until each user next changes their password, so plan a password-rotation if migrating away from a weak scheme. The change itself is safe for active sessions. Avoid removing the password line entirely or mistyping the PAM stack, as a broken pam.d file can lock out logins; test in a console session before closing your only access.

Standards mapping

StandardReferenceTypeVersionConfidence
ANSSI BP-028R68direct2.0high
CIS5.3.3.4.3, 8.3.2directper OS, see the benchmark tablehigh
NIST3.13.11, CM-6(a), IA-5(1)(c), IA-5(c)supporting800-53 Rev 5 · 800-171 Rev 2 (pinned)medium
PCI DSS8.3.2supporting4.0.1medium

Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.

Sources & references